The ca-certificates package was just updated, and it caused the following changes on my Xubuntu 13.10 system:

Running hooks in /etc/ca-certificates/update.d....
Adding debian:CA_Disig_Root_R1.pem
Adding debian:CA_Disig_Root_R2.pem
Adding debian:China_Internet_Network_Information_Center_EV_Certificates_Root.pem
Adding debian:D-TRUST_Root_Class_3_CA_2_2009.pem
Adding debian:D-TRUST_Root_Class_3_CA_2_EV_2009.pem
Adding debian:PSCProcert.pem
Adding debian:StartCom_Certification_Authority_2.pem
Adding debian:Swisscom_Root_CA_2.pem
Adding debian:Swisscom_Root_EV_CA_2.pem
Adding debian:TURKTRUST_Certificate_Services_Provider_Root_2007.pem
Adding debian:Verisign_Class_3_Public_Primary_Certification_Authority_2.pem
Removing debian:cacert.org_class3.pem
Removing debian:cacert.org_root.pem
Removing debian:Equifax_Secure_eBusiness_CA_2.pem
Removing debian:TC_TrustCenter_Universal_CA_III.pem

I've decided I don't trust some of these CAs, and I would like to remove their certificates. How do I do that?

1 Answer 1



sudo dpkg-reconfigure ca-certificates

That should give you a list where you can deselect CAs.

The list of CAs is stored in the file /etc/ca-certificates.conf. If you edit this file manually you need to run

sudo update-ca-certificates

to update the actual certificates in /etc/ssl/certs/ (if you use dpkg-reconfigure that is done automatically).

See /usr/share/doc/ca-certificates/README.Debian for more information.

  • 1
    This worked flawlessly and was far easier than I expected it would be. The Debian contributors deserve a lot of credit for making it so painless. Thanks for your answer! Mar 29, 2014 at 13:48
  • ensure you don't have a package manager open. Mar 25, 2015 at 22:16
  • I downloaded a certificate, when I double click on it, gcr-viewer opens and allows me to import it using root password. But after the import, the file /etc/ca-certificates.conf does not contain it, any idea? here the question: askubuntu.com/questions/749073/… Mar 22, 2016 at 18:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .